The vulnerability CVE-2024-8989 affects the 'Stars Testimonials — Responsive Reviews & Star Ratings' WordPress plugin, allowing stored cross-site scripting via the stars_testimonials shortcode. Due to improper neutralization of input (CWE-79), authenticated users with contributor or higher privileges can inject arbitrary JavaScript code. This code executes in the context of any user viewing the injected page, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages using the stars_testimonials shortcode. These scripts execute in the browsers of users who visit the affected pages, potentially compromising user sessions or data confidentiality and integrity. There is no direct impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access and above to trusted users only. Consider disabling or removing the plugin if feasible. Monitor for updates from the vendor and apply official patches promptly once released.